{"code":"var Component=(()=>{var p=Object.create;var s=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var g=Object.getOwnPropertyNames;var m=Object.getPrototypeOf,u=Object.prototype.hasOwnProperty;var y=(n,i)=>()=>(i||n((i={exports:{}}).exports,i),i.exports),f=(n,i)=>{for(var r in i)s(n,r,{get:i[r],enumerable:!0})},t=(n,i,r,a)=>{if(i&&typeof i==\"object\"||typeof i==\"function\")for(let l of g(i))!u.call(n,l)&&l!==r&&s(n,l,{get:()=>i[l],enumerable:!(a=k(i,l))||a.enumerable});return n};var b=(n,i,r)=>(r=n!=null?p(m(n)):{},t(i||!n||!n.__esModule?s(r,\"default\",{value:n,enumerable:!0}):r,n)),w=n=>t(s({},\"__esModule\",{value:!0}),n);var h=y((C,c)=>{c.exports=_jsx_runtime});var v={};f(v,{default:()=>o});var e=b(h());function d(n){let i={a:\"a\",code:\"code\",em:\"em\",h2:\"h2\",h3:\"h3\",hr:\"hr\",img:\"img\",li:\"li\",ol:\"ol\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",table:\"table\",tbody:\"tbody\",td:\"td\",th:\"th\",thead:\"thead\",tr:\"tr\",ul:\"ul\",...n.components};return(0,e.jsxs)(e.Fragment,{children:[(0,e.jsx)(i.p,{children:\"A sophisticated new variant of MacSync Stealer malware has emerged that exploits Apple's own security infrastructure to bypass Gatekeeper protections. Discovered by Jamf Threat Labs in December 2025, this threat represents a significant evolution in macOS malware distribution, using code-signed and Apple-notarized applications to evade detection and steal sensitive data including cryptocurrency wallets, browser credentials, and system information.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"MacSync Stealer Security Threat\",src:\"/images/blog/macsync-stealer-security-guide-2025/cybersecurity-threat.jpg\",width:\"2400\",height:\"1600\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"executive-summary-the-macsync-stealer-threat\",children:\"Executive Summary: The MacSync Stealer Threat\"}),`\n`,(0,e.jsx)(i.h3,{id:\"critical-security-alert\",children:\"Critical Security Alert\"}),`\n`,(0,e.jsx)(i.p,{children:\"MacSync Stealer represents one of the most sophisticated macOS malware threats of 2025, exploiting a fundamental weakness in Apple's security architecture. Unlike previous malware that relied on tricking users into bypassing security warnings, this variant passes all Gatekeeper and XProtect checks because it carries legitimate Apple notarization.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Key Threat Characteristics:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Apple-Notarized\"}),\": Passes Gatekeeper security checks without warnings\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Code-Signed\"}),\": Uses valid Developer ID (Team ID: GNJLS3UYZ4, now revoked)\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Multi-Stage Payload\"}),\": Initial binary is benign; malicious payload delivered post-installation\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Comprehensive Data Theft\"}),\": Targets browsers, cryptocurrency wallets, Keychain, and Telegram\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Backdoor Capability\"}),\": Includes Go-based backdoor for persistent access\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Who Is at Risk:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Cryptocurrency holders and traders\"}),`\n`,(0,e.jsx)(i.li,{children:\"Users who download software from unofficial sources\"}),`\n`,(0,e.jsx)(i.li,{children:\"Enterprise environments without advanced endpoint protection\"}),`\n`,(0,e.jsx)(i.li,{children:\"Anyone who trusts applications solely based on Gatekeeper approval\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"the-growing-macos-malware-landscape\",children:\"The Growing macOS Malware Landscape\"}),`\n`,(0,e.jsx)(i.p,{children:\"The MacSync Stealer emergence occurs against a backdrop of rapidly escalating macOS threats:\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Metric\"}),(0,e.jsx)(i.th,{children:\"2024 vs 2025\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"macOS Threat Growth\"}),(0,e.jsx)(i.td,{children:\"400% increase (Red Canary)\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"AMOS Malware Detections\"}),(0,e.jsx)(i.td,{children:\"300% spike in August 2025\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"ClickFix Attack Surge\"}),(0,e.jsx)(i.td,{children:\"517% increase in H1 2025\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Mac Users Encountering Threats\"}),(0,e.jsx)(i.td,{children:\"66% experienced at least one cyber threat\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Global AMOS Campaign Reach\"}),(0,e.jsx)(i.td,{children:\"120+ countries\"})]})]})]}),`\n`,(0,e.jsx)(i.p,{children:\"The entry-level price for Mac stealer malware has dropped from $3,000 to $1,000 per month, making these tools accessible to a broader range of cybercriminals.\"}),`\n`,(0,e.jsx)(i.h2,{id:\"technical-analysis-how-macsync-stealer-works\",children:\"Technical Analysis: How MacSync Stealer Works\"}),`\n`,(0,e.jsx)(i.h3,{id:\"origins-and-evolution\",children:\"Origins and Evolution\"}),`\n`,(0,e.jsx)(i.p,{children:'MacSync Stealer emerged as a rebrand of the \"mac.c stealer,\" which first appeared in April 2025 under the threat actor \"Mentalpositive.\" The malware was subsequently acquired and significantly enhanced by a developer who transformed it from a basic credential stealer into a comprehensive threat with backdoor capabilities.'}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Technical Architecture:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Primary Component\"}),\": C-based data-stealing module\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Persistence Mechanism\"}),\": Fully-featured Go-based backdoor agent\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Distribution Model\"}),\": Malware-as-a-Service (MaaS)\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Current Market Price\"}),\": $1,000/month (down from $3,000)\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"the-notarization-bypass-technique\",children:\"The Notarization Bypass Technique\"}),`\n`,(0,e.jsx)(i.p,{children:\"The December 2025 variant represents a paradigm shift in macOS malware distribution. Rather than relying on social engineering to bypass security warnings, attackers exploit Apple's own security infrastructure.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Attack Flow:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"1. Attacker creates benign Swift application\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"2. Submits to Apple for notarization\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"3. Apple's automated scanning approves (no malware detected)\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"4. Attacker receives notarization ticket\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"5. Application distributed with valid signature\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"6. User downloads and opens without Gatekeeper warning\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"7. Post-installation, app contacts C2 server\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"8. Malicious payload delivered and executed\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"          \\u2193\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"9. Data exfiltration begins\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Why This Attack Succeeds:\"})}),`\n`,(0,e.jsx)(i.p,{children:`Apple's notarization process evaluates what exists at submission time, not runtime behavior. Security researcher Jeff Johnson (Lapcat Software) explains: \"Apple's notarization service scans for malware, but malware authors don't need to submit malware to Apple! They can submit a perfectly innocent app for notarization... It's impossible for Apple to detect this beforehand.\"`}),`\n`,(0,e.jsx)(i.h3,{id:\"detailed-infection-chain\",children:\"Detailed Infection Chain\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Stage 1: Initial Distribution\"})}),`\n`,(0,e.jsxs)(i.p,{children:[\"The malware distributes as a disk image named \",(0,e.jsx)(i.code,{children:\"zk-call-messenger-installer-3.9.2-lts.dmg\"}),\", hosted at \",(0,e.jsx)(i.code,{children:\"https://zkcall.net/download\"}),\". The DMG file is inflated to 25.5MB using decoy PDF files (LibreOffice-related documents) to appear legitimate.\"]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Stage 2: Pre-Execution Validation\"})}),`\n`,(0,e.jsx)(i.p,{children:\"Upon mounting, the code-signed Swift executable performs several checks:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M7.508 0c-.287 0-.573 0-.86.002-.241.002-.483.003-.724.01-.132.003-.263.009-.395.015A9.154 9.154 0 0 0 4.348.15 5.492 5.492 0 0 0 2.85.645 5.04 5.04 0 0 0 .645 2.848c-.245.48-.4.972-.495 1.5-.093.52-.122 1.05-.136 1.576a35.2 35.2 0 0 0-.012.724C0 6.935 0 7.221 0 7.508v8.984c0 .287 0 .575.002.862.002.24.005.481.012.722.014.526.043 1.057.136 1.576.095.528.25 1.02.495 1.5a5.03 5.03 0 0 0 2.205 2.203c.48.244.97.4 1.498.495.52.093 1.05.124 1.576.138.241.007.483.009.724.01.287.002.573.002.86.002h8.984c.287 0 .573 0 .86-.002.241-.001.483-.003.724-.01a10.523 10.523 0 0 0 1.578-.138 5.322 5.322 0 0 0 1.498-.495 5.035 5.035 0 0 0 2.203-2.203c.245-.48.4-.972.495-1.5.093-.52.124-1.05.138-1.576.007-.241.009-.481.01-.722.002-.287.002-.575.002-.862V7.508c0-.287 0-.573-.002-.86a33.662 33.662 0 0 0-.01-.724 10.5 10.5 0 0 0-.138-1.576 5.328 5.328 0 0 0-.495-1.5A5.039 5.039 0 0 0 21.152.645 5.32 5.32 0 0 0 19.654.15a10.493 10.493 0 0 0-1.578-.138 34.98 34.98 0 0 0-.722-.01C17.067 0 16.779 0 16.492 0H7.508zm6.035 3.41c4.114 2.47 6.545 7.162 5.549 11.131-.024.093-.05.181-.076.272l.002.001c2.062 2.538 1.5 5.258 1.236 4.745-1.072-2.086-3.066-1.568-4.088-1.043a6.803 6.803 0 0 1-.281.158l-.02.012-.002.002c-2.115 1.123-4.957 1.205-7.812-.022a12.568 12.568 0 0 1-5.64-4.838c.649.48 1.35.902 2.097 1.252 3.019 1.414 6.051 1.311 8.197-.002C9.651 12.73 7.101 9.67 5.146 7.191a10.628 10.628 0 0 1-1.005-1.384c2.34 2.142 6.038 4.83 7.365 5.576C8.69 8.408 6.208 4.743 6.324 4.86c4.436 4.47 8.528 6.996 8.528 6.996.154.085.27.154.36.213.085-.215.16-.437.224-.668.708-2.588-.09-5.548-1.893-7.992z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"// Simplified representation of pre-execution checks\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\"func\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" checkInternet\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"() \"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\"->\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" Bool\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\" {\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"    // Verify network connectivity\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"    // Avoids execution in sandboxed/offline environments\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"}\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\"func\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" checkRateLimit\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"() \"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\"->\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" Bool\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\" {\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"    // Enforce 3600-second minimum between executions\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"    // Prevents analysis through repeated runs\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"}\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Stage 3: Payload Retrieval\"})}),`\n`,(0,e.jsx)(i.p,{children:\"If checks pass, the application:\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[\"Fetches obfuscated bash script from \",(0,e.jsx)(i.code,{children:\"gatemaden.space\"})]}),`\n`,(0,e.jsxs)(i.li,{children:[\"Writes script to \",(0,e.jsx)(i.code,{children:\"/tmp/runner\"}),\" with executable permissions\"]}),`\n`,(0,e.jsx)(i.li,{children:\"Validates script authenticity via file-type inspection\"}),`\n`,(0,e.jsx)(i.li,{children:`Expects: \"Paul Falstad's zsh script text executable\"`}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Stage 4: Payload Execution\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Decoded payload execution\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"base64\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -D\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" gunzip\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" /bin/zsh\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -lc\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Evaluates daemon_function() routine\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Stage 5: Data Exfiltration\"})}),`\n`,(0,e.jsxs)(i.p,{children:[\"The malware communicates with \",(0,e.jsx)(i.code,{children:\"focusgroovy.com\"}),\" for credential theft operations:\"]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Displays fake password prompt to harvest system credentials\"}),`\n`,(0,e.jsx)(i.li,{children:\"Deploys Go-based backdoor for persistent access\"}),`\n`,(0,e.jsx)(i.li,{children:\"Exfiltrates collected data to command and control infrastructure\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"evasion-techniques\",children:\"Evasion Techniques\"}),`\n`,(0,e.jsx)(i.p,{children:\"MacSync Stealer employs multiple sophisticated evasion mechanisms:\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Technique\"}),(0,e.jsx)(i.th,{children:\"Purpose\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"DMG inflation with decoy files\"}),(0,e.jsx)(i.td,{children:\"Appear legitimate, bypass file-size heuristics\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"In-memory execution\"}),(0,e.jsx)(i.td,{children:\"Minimize disk artifacts for forensic analysis\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Internet connectivity checks\"}),(0,e.jsx)(i.td,{children:\"Avoid sandboxed analysis environments\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Quarantine attribute removal\"}),(0,e.jsx)(i.td,{children:\"Bypass macOS security flags\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsxs)(i.td,{children:[\"Script validation via \",(0,e.jsx)(i.code,{children:\"/usr/bin/file\"})]}),(0,e.jsx)(i.td,{children:\"Ensure payload integrity\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsxs)(i.td,{children:[\"Modified curl flags (\",(0,e.jsx)(i.code,{children:\"-fL\"}),\", \",(0,e.jsx)(i.code,{children:\"-sS\"}),\", \",(0,e.jsx)(i.code,{children:\"--noproxy\"}),\")\"]}),(0,e.jsx)(i.td,{children:\"Evade network monitoring\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Rate limiting (3600s intervals)\"}),(0,e.jsx)(i.td,{children:\"Prevent automated analysis\"})]})]})]}),`\n`,(0,e.jsx)(i.h2,{id:\"what-data-macsync-stealer-targets\",children:\"What Data MacSync Stealer Targets\"}),`\n`,(0,e.jsx)(i.h3,{id:\"browser-credentials-and-data\",children:\"Browser Credentials and Data\"}),`\n`,(0,e.jsx)(i.p,{children:\"MacSync Stealer targets every major Chromium-based browser:\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Targeted Browsers:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Google Chrome (including Beta, Dev, Canary)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Brave Browser\"}),`\n`,(0,e.jsx)(i.li,{children:\"Microsoft Edge\"}),`\n`,(0,e.jsx)(i.li,{children:\"Vivaldi\"}),`\n`,(0,e.jsx)(i.li,{children:\"Opera / Opera GX\"}),`\n`,(0,e.jsx)(i.li,{children:\"Yandex Browser\"}),`\n`,(0,e.jsx)(i.li,{children:\"Arc Browser\"}),`\n`,(0,e.jsx)(i.li,{children:\"Chromium\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Data Extracted:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Saved passwords and login credentials\"}),`\n`,(0,e.jsx)(i.li,{children:\"Browser cookies (session tokens for account takeover)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Form autofill data (addresses, credit cards)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Browsing history\"}),`\n`,(0,e.jsx)(i.li,{children:\"Extension secrets and configurations\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"cryptocurrency-wallets\",children:\"Cryptocurrency Wallets\"}),`\n`,(0,e.jsx)(i.p,{children:\"The malware specifically targets cryptocurrency assets, reflecting the high-value nature of this data:\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Standalone Wallet Applications:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Exodus\"}),`\n`,(0,e.jsx)(i.li,{children:\"Electrum\"}),`\n`,(0,e.jsx)(i.li,{children:\"Atomic Wallet\"}),`\n`,(0,e.jsx)(i.li,{children:\"Guarda\"}),`\n`,(0,e.jsx)(i.li,{children:\"Coinomi\"}),`\n`,(0,e.jsx)(i.li,{children:\"Sparrow\"}),`\n`,(0,e.jsx)(i.li,{children:\"Wasabi\"}),`\n`,(0,e.jsx)(i.li,{children:\"Bitcoin Core\"}),`\n`,(0,e.jsx)(i.li,{children:\"Litecoin Core\"}),`\n`,(0,e.jsx)(i.li,{children:\"Dash Core\"}),`\n`,(0,e.jsx)(i.li,{children:\"Dogecoin Core\"}),`\n`,(0,e.jsx)(i.li,{children:\"BlueWallet\"}),`\n`,(0,e.jsx)(i.li,{children:\"Zengo\"}),`\n`,(0,e.jsx)(i.li,{children:\"Trust Wallet\"}),`\n`,(0,e.jsx)(i.li,{children:\"Ledger Live\"}),`\n`,(0,e.jsx)(i.li,{children:\"Trezor Suite\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Browser-Based Wallets:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"MetaMask\"}),`\n`,(0,e.jsx)(i.li,{children:\"Coinbase Wallet\"}),`\n`,(0,e.jsx)(i.li,{children:\"Phantom\"}),`\n`,(0,e.jsx)(i.li,{children:\"Other browser extension wallets\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"system-and-application-data\",children:\"System and Application Data\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Keychain Access:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"iCloud Keychain credentials\"}),`\n`,(0,e.jsx)(i.li,{children:\"Wi-Fi passwords\"}),`\n`,(0,e.jsx)(i.li,{children:\"Application passwords\"}),`\n`,(0,e.jsx)(i.li,{children:\"Stored certificates\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Communication Apps:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Telegram session data (enables full account takeover)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Messaging app credentials\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"System Information:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Hardware specifications\"}),`\n`,(0,e.jsx)(i.li,{children:\"Installed applications list\"}),`\n`,(0,e.jsx)(i.li,{children:\"Network configurations\"}),`\n`,(0,e.jsx)(i.li,{children:\"macOS version and system metadata\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Personal Files:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Documents and images\"}),`\n`,(0,e.jsx)(i.li,{children:\"Corporate/business data\"}),`\n`,(0,e.jsx)(i.li,{children:\"Configuration files\"}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"indicators-of-compromise-iocs\",children:\"Indicators of Compromise (IOCs)\"}),`\n`,(0,e.jsx)(i.h3,{id:\"file-hashes-sha256\",children:\"File Hashes (SHA256)\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Disk Images:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"zk-call-messenger-installer-3.9.2-lts.dmg:\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"be961ec5b9f4cc501ed5d5b8974b730dabcdf7e279ed4a8c037c67b5b935d51a\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"co.runtime.helper.b3f9a2.dmg:\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"4ae745bc0e4631f676b3d0a05d5c74e37bdfc8da3076208b24e73e5bbea9178f\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Mach-O Executables (runtimectl):\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"ecfaa20f25e11878686249c7094706bc3dcd2dc0ace0f2932a39d1bfdac85863\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"7cfe0b119e616ac81ddb1767a5c7f40bec67d91fdd66e53490c0225789537073\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"06c74829d8eee3c47e17d01c41361d314f12277d899cc9dfa789fe767c03693e\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"c4d3e5cdb264eded917cd61b8131c40715c0ee3f4d2c94c84d60fa295ca4ed97\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"9990457feac0cd85f450e60c268ddf5789ed4ac81022b0d7c3021d7208ebccd3\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"9d43e059111460c4f81351a062fb7eb7dbfd34988a06d756c7206f330c06cb42\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Payload Script (runner):\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"2e671bd9673d174de9b4ad8fd03049859e1d2d17ac9bc49ecc5d736505002937\"})})})})}),`\n`,(0,e.jsx)(i.h3,{id:\"network-indicators\",children:\"Network Indicators\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Indicator Type\"}),(0,e.jsx)(i.th,{children:\"Value\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"User Agent\"}),(0,e.jsx)(i.td,{children:(0,e.jsx)(i.code,{children:\"UserSyncWorker/1.0 (macOS)\"})})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"C2 Domain\"}),(0,e.jsx)(i.td,{children:(0,e.jsx)(i.code,{children:\"focusgroovy.com\"})})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Payload Domain\"}),(0,e.jsx)(i.td,{children:(0,e.jsx)(i.code,{children:\"gatemaden.space\"})})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Distribution Domain\"}),(0,e.jsx)(i.td,{children:(0,e.jsx)(i.code,{children:\"zkcall.net\"})})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Developer Team ID\"}),(0,e.jsx)(i.td,{children:\"GNJLS3UYZ4 (revoked)\"})]})]})]}),`\n`,(0,e.jsx)(i.h3,{id:\"file-system-indicators\",children:\"File System Indicators\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Temporary Files:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.code,{children:\"/tmp/runner\"}),\" (temporary payload)\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.code,{children:\"/tmp/runner.headers\"}),\" (header cache)\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Persistence Locations:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:(0,e.jsx)(i.code,{children:\"~/Library/Logs/UserSyncWorker.log\"})}),`\n`,(0,e.jsx)(i.li,{children:(0,e.jsx)(i.code,{children:\"~/Library/Application Support/UserSyncWorker/\"})}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Timing Tracker Files:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:(0,e.jsx)(i.code,{children:\"last_up\"})}),`\n`,(0,e.jsx)(i.li,{children:(0,e.jsx)(i.code,{children:\"gate\"})}),`\n`,(0,e.jsx)(i.li,{children:(0,e.jsx)(i.code,{children:\"last_update\"})}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"log-patterns\",children:\"Log Patterns\"}),`\n`,(0,e.jsx)(i.p,{children:\"Look for these patterns in system logs:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:'\"Starting update...\"'}),`\n`,(0,e.jsx)(i.li,{children:'\"rate-limit: defer\"'}),`\n`,(0,e.jsx)(i.li,{children:'\"preflight: internet=\"'}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"detection-methods\",children:\"Detection Methods\"}),`\n`,(0,e.jsx)(i.h3,{id:\"using-activity-monitor\",children:\"Using Activity Monitor\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[\"Open \",(0,e.jsx)(i.strong,{children:\"Applications > Utilities > Activity Monitor\"})]}),`\n`,(0,e.jsxs)(i.li,{children:[\"Click the \",(0,e.jsx)(i.strong,{children:\"CPU\"}),\" tab and sort by \",(0,e.jsx)(i.strong,{children:\"%CPU\"}),\" usage\"]}),`\n`,(0,e.jsx)(i.li,{children:\"Look for unfamiliar processes consuming high resources\"}),`\n`,(0,e.jsx)(i.li,{children:'Check for processes named similar to \"UserSyncWorker\"'}),`\n`,(0,e.jsxs)(i.li,{children:[\"Select suspicious processes and click \",(0,e.jsx)(i.strong,{children:\"'i'\"}),\" for more information\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"Activity Monitor Detection\",src:\"/images/blog/macsync-stealer-security-guide-2025/terminal-code-screen.jpg\",width:\"2400\",height:\"1600\"})}),`\n`,(0,e.jsx)(i.h3,{id:\"terminal-commands-for-detection\",children:\"Terminal Commands for Detection\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Check Network Connections:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# View active network connections\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"netstat\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -an\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ESTABLISHED\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# List processes with network connections\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"lsof\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -i\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -P\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ESTABLISHED\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Examine Running Daemons:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# List all running agents and daemons\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"launchctl\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" list\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check for suspicious XPC services\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"launchctl\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" print\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" system\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Check Previous Logins:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# View login history for unauthorized access\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"last\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Search for IOC Files:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check for MacSync-specific files\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /tmp/runner\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"*\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"/dev/null\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Logs/UserSyncWorker.log\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"/dev/null\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Application\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"\\\\ \"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"Support/UserSyncWorker/\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"/dev/null\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Check LaunchAgents:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# List user LaunchAgents\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/LaunchAgents/\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# List system LaunchAgents\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/LaunchAgents/\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# List LaunchDaemons\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/LaunchDaemons/\"})]})]})})}),`\n`,(0,e.jsx)(i.h3,{id:\"antivirus-detection-names\",children:\"Antivirus Detection Names\"}),`\n`,(0,e.jsx)(i.p,{children:\"Different security vendors may detect MacSync Stealer under various names:\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Vendor\"}),(0,e.jsx)(i.th,{children:\"Detection Name\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Avast\"}),(0,e.jsx)(i.td,{children:\"MacOS:Agent-AYE [PUP]\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Combo Cleaner\"}),(0,e.jsx)(i.td,{children:\"Trojan.GenericKD.77251890\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Kaspersky\"}),(0,e.jsx)(i.td,{children:\"HEUR:Trojan.OSX.Agent.gen\"})]})]})]}),`\n`,(0,e.jsx)(i.h2,{id:\"removal-guide\",children:\"Removal Guide\"}),`\n`,(0,e.jsx)(i.h3,{id:\"immediate-response-steps\",children:\"Immediate Response Steps\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Step 1: Disconnect from Network\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Disable Wi-Fi from Terminal\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"networksetup\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -setairportpower\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" en0\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" off\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:\"Or manually: Click Wi-Fi icon > Turn Wi-Fi Off\"}),`\n`,(0,e.jsx)(i.p,{children:\"Unplug Ethernet cables to prevent further data exfiltration.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Step 2: Boot into Safe Mode\"})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.em,{children:\"For Apple Silicon Macs:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Shut down your Mac\"}),`\n`,(0,e.jsx)(i.li,{children:'Press and hold the power button until \"Loading startup options\" appears'}),`\n`,(0,e.jsx)(i.li,{children:\"Select your volume\"}),`\n`,(0,e.jsx)(i.li,{children:'Press and hold Shift, then click \"Continue in Safe Mode\"'}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.em,{children:\"For Intel Macs:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Restart your Mac\"}),`\n`,(0,e.jsx)(i.li,{children:\"Immediately press and hold Shift\"}),`\n`,(0,e.jsx)(i.li,{children:\"Release when login window appears\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Step 3: Remove Suspicious Files\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Remove known MacSync files\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"rm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -rf\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /tmp/runner\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"rm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -rf\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /tmp/runner.headers\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"rm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -rf\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Logs/UserSyncWorker.log\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"rm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -rf\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Application\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"\\\\ \"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"Support/UserSyncWorker/\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check and remove suspicious LaunchAgents\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# First, list them to identify suspicious entries\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/LaunchAgents/\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/LaunchAgents/\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/LaunchDaemons/\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Remove any suspicious .plist files (replace with actual filename)\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# launchctl unload ~/Library/LaunchAgents/suspicious.plist\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# rm ~/Library/LaunchAgents/suspicious.plist\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Step 4: Review Login Items\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[\"Open \",(0,e.jsx)(i.strong,{children:\"System Settings > General > Login Items\"})]}),`\n`,(0,e.jsx)(i.li,{children:\"Review all listed applications\"}),`\n`,(0,e.jsx)(i.li,{children:\"Remove any unrecognized entries by clicking the minus (-) button\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Step 5: Reset Browsers\"})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.em,{children:\"For Chrome:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Open Chrome > Settings > Reset settings\"}),`\n`,(0,e.jsx)(i.li,{children:'Click \"Restore settings to their original defaults\"'}),`\n`,(0,e.jsx)(i.li,{children:'Confirm by clicking \"Reset settings\"'}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.em,{children:\"For Safari:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Safari > Settings > Privacy > Manage Website Data\"}),`\n`,(0,e.jsx)(i.li,{children:\"Remove All\"}),`\n`,(0,e.jsx)(i.li,{children:\"Clear History: Safari > Clear History > All History\"}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.em,{children:\"For Other Browsers:\"}),`\nFollow similar reset procedures in each browser's settings.`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Step 6: Run Antimalware Scan\"})}),`\n`,(0,e.jsx)(i.p,{children:\"Recommended tools:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Combo Cleaner\"}),\": Comprehensive Mac malware removal\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Malwarebytes for Mac\"}),\": Free scanning with paid removal\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Moonlock\"}),\": Lightweight Mac-native protection\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Step 7: Change All Credentials\"})}),`\n`,(0,e.jsx)(i.p,{children:\"After removal, immediately:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Change all passwords stored in browsers or Keychain\"}),`\n`,(0,e.jsx)(i.li,{children:\"Revoke and regenerate 2FA tokens\"}),`\n`,(0,e.jsx)(i.li,{children:\"Transfer cryptocurrency to new wallets with new seed phrases\"}),`\n`,(0,e.jsx)(i.li,{children:\"Monitor accounts for unauthorized activity\"}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"protection-strategies\",children:\"Protection Strategies\"}),`\n`,(0,e.jsx)(i.h3,{id:\"software-download-safety\",children:\"Software Download Safety\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Best Practices:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Install apps only from the Mac App Store or verified developer websites\"}),`\n`,(0,e.jsx)(i.li,{children:\"Avoid downloading software from unknown or unofficial sources\"}),`\n`,(0,e.jsx)(i.li,{children:\"Double-check URLs before downloading (look for typos or suspicious domains)\"}),`\n`,(0,e.jsx)(i.li,{children:'Be extremely cautious with \"cracked\" software or installers found on forums'}),`\n`,(0,e.jsx)(i.li,{children:\"Verify application signatures before installation\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"How to Verify Application Signatures:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:'Right-click the app > Select \"Get Info\"'}),`\n`,(0,e.jsx)(i.li,{children:'Look for Developer ID information under \"General\" section'}),`\n`,(0,e.jsx)(i.li,{children:\"Be wary of applications signed by unknown developers\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"enable-macos-security-features\",children:\"Enable macOS Security Features\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Gatekeeper Settings:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"System Settings > Privacy & Security\"}),`\n`,(0,e.jsx)(i.li,{children:'Under \"Allow applications downloaded from,\" select \"App Store and identified developers\"'}),`\n`,(0,e.jsx)(i.li,{children:\"Never disable Gatekeeper permanently\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Keep XProtect Updated:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"XProtect updates automatically in the background\"}),`\n`,(0,e.jsx)(i.li,{children:\"Ensure automatic updates are enabled in System Settings\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Enable FileVault:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"System Settings > Privacy & Security > FileVault\"}),`\n`,(0,e.jsx)(i.li,{children:\"Turn on FileVault for full-disk encryption\"}),`\n`,(0,e.jsx)(i.li,{children:\"Store recovery key securely\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Keep SIP Enabled:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"System Integrity Protection should remain enabled\"}),`\n`,(0,e.jsx)(i.li,{children:\"Never disable SIP unless absolutely necessary for specific development tasks\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"browser-security-best-practices\",children:\"Browser Security Best Practices\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Use a Password Manager\"}),\": Don't rely on browser-stored passwords\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Enable 2FA\"}),\": Activate two-factor authentication for all critical accounts\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Regular Extension Audits\"}),\": Review and remove unnecessary browser extensions\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Clear Session Data\"}),\": Periodically clear cookies and session data\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Use Separate Profiles\"}),\": Create separate browser profiles for sensitive activities\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"cryptocurrency-protection\",children:\"Cryptocurrency Protection\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Hardware Wallet Usage:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Use hardware wallets (Ledger, Trezor) for significant holdings\"}),`\n`,(0,e.jsx)(i.li,{children:\"Never enter seed phrases on any website or application\"}),`\n`,(0,e.jsx)(i.li,{children:\"Verify wallet addresses on the hardware device screen before transactions\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Software Wallet Security:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Enable all available 2FA options on exchange accounts\"}),`\n`,(0,e.jsx)(i.li,{children:\"Use multi-signature wallets for large amounts\"}),`\n`,(0,e.jsx)(i.li,{children:\"Store recovery phrases offline in multiple secure locations\"}),`\n`,(0,e.jsx)(i.li,{children:\"Verify wallet software downloads from official sources only\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Transaction Safety:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Always verify addresses before sending cryptocurrency\"}),`\n`,(0,e.jsx)(i.li,{children:\"Use a separate device to confirm large transactions\"}),`\n`,(0,e.jsx)(i.li,{children:'Be suspicious of any request to \"verify\" or \"validate\" your wallet'}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"enterprise-security-recommendations\",children:\"Enterprise Security Recommendations\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Endpoint Protection:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Deploy EDR solutions like Jamf Protect, CrowdStrike, or SentinelOne\"}),`\n`,(0,e.jsx)(i.li,{children:'Enable advanced threat controls in \"block mode\"'}),`\n`,(0,e.jsx)(i.li,{children:\"Implement application whitelisting where possible\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"MDM Configuration:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Use Mobile Device Management for centralized security policy\"}),`\n`,(0,e.jsx)(i.li,{children:\"Restrict software installation to approved sources\"}),`\n`,(0,e.jsx)(i.li,{children:\"Enable automatic security updates\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"User Training:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Conduct regular security awareness training\"}),`\n`,(0,e.jsx)(i.li,{children:\"Emphasize risks of downloading software from unofficial sources\"}),`\n`,(0,e.jsx)(i.li,{children:\"Establish clear reporting procedures for suspicious activity\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Network Security:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Implement DNS filtering to block known malicious domains\"}),`\n`,(0,e.jsx)(i.li,{children:\"Monitor network traffic for suspicious C2 communications\"}),`\n`,(0,e.jsx)(i.li,{children:\"Segment network to limit lateral movement\"}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"apples-response-and-security-implications\",children:\"Apple's Response and Security Implications\"}),`\n`,(0,e.jsx)(i.h3,{id:\"actions-taken\",children:\"Actions Taken\"}),`\n`,(0,e.jsx)(i.p,{children:\"Following Jamf Threat Labs' disclosure:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Apple revoked the certificate associated with Developer Team ID GNJLS3UYZ4\"}),`\n`,(0,e.jsx)(i.li,{children:\"The specific signing certificate is no longer valid for new installations\"}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Important Limitation:\"}),`\nCode directory hashes were not included in Apple's revocation list at the time of Jamf's report publication, meaning some variants may still execute on systems that previously allowed them.`]}),`\n`,(0,e.jsx)(i.h3,{id:\"the-fundamental-security-challenge\",children:\"The Fundamental Security Challenge\"}),`\n`,(0,e.jsx)(i.p,{children:\"The MacSync case exposes a fundamental weakness in Apple's security architecture:\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Design Limitation:\"}),`\nNotarization evaluates submissions at a point in time, not runtime behavior. This creates an inherent window of vulnerability.`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Expert Analysis:\"})}),`\n`,(0,e.jsx)(i.p,{children:\"Security researcher Chris Miller notes that Gatekeeper only verifies developer certificates and checks known-malware lists when an application is first opened. Malware that passes initial inspection won't be stopped later.\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"The Reality:\"}),`\nThe system largely works as designed. Code signing and notarization were never intended to guarantee software remains benign forever\\u2014only that it can be traced and revoked when abuse is discovered. However, this reactive approach leaves users vulnerable during the detection gap.`]}),`\n`,(0,e.jsx)(i.h3,{id:\"what-this-means-for-users\",children:\"What This Means for Users\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Notarization is not a guarantee\"}),\": A notarized app can still be malicious\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"First-run checks are not sufficient\"}),\": Malware can activate after initial approval\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Vigilance remains essential\"}),\": Users must maintain security awareness regardless of Gatekeeper approval\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Defense in depth\"}),\": Multiple security layers are necessary for comprehensive protection\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"related-macos-threats\",children:\"Related macOS Threats\"}),`\n`,(0,e.jsx)(i.h3,{id:\"amos-atomic-macos-stealer\",children:\"AMOS (Atomic macOS Stealer)\"}),`\n`,(0,e.jsx)(i.p,{children:\"The most prevalent Mac malware in the cybercriminal underground for three years:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Active since April 2023\"}),`\n`,(0,e.jsx)(i.li,{children:\"2025 update added embedded backdoor for persistent access\"}),`\n`,(0,e.jsx)(i.li,{children:\"Second known case of backdoor deployment at global scale (after North Korean hackers)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Targets similar data categories as MacSync\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"nova-stealer\",children:\"Nova Stealer\"}),`\n`,(0,e.jsx)(i.p,{children:\"Emerged November 2025:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Focuses primarily on cryptocurrency theft\"}),`\n`,(0,e.jsx)(i.li,{children:\"Masquerades as legitimate wallet software (Ledger Live, Trezor Suite)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Uses social engineering to gain initial access\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"cthulhu-stealer\",children:\"Cthulhu Stealer\"}),`\n`,(0,e.jsx)(i.p,{children:\"Another active information stealer with:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Similar data-stealing capabilities\"}),`\n`,(0,e.jsx)(i.li,{children:\"Primary focus on browser credentials and cryptocurrency\"}),`\n`,(0,e.jsx)(i.li,{children:\"Different distribution methods but comparable impact\"}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"recommended-security-solutions\",children:\"Recommended Security Solutions\"}),`\n`,(0,e.jsx)(i.h3,{id:\"for-individual-users\",children:\"For Individual Users\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Solution\"}),(0,e.jsx)(i.th,{children:\"Price\"}),(0,e.jsx)(i.th,{children:\"Key Features\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Moonlock\"}),(0,e.jsx)(i.td,{children:\"$37.80/year\"}),(0,e.jsx)(i.td,{children:\"Lightweight, Mac-native, real-time protection\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Malwarebytes\"}),(0,e.jsx)(i.td,{children:\"Free (basic) / $44.99/year\"}),(0,e.jsx)(i.td,{children:\"On-demand scanning, real-time (paid)\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Intego VirusBarrier\"}),(0,e.jsx)(i.td,{children:\"$49.99/year\"}),(0,e.jsx)(i.td,{children:\"Comprehensive Mac security suite\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Combo Cleaner\"}),(0,e.jsx)(i.td,{children:\"$59.95/year\"}),(0,e.jsx)(i.td,{children:\"Malware removal, system optimization\"})]})]})]}),`\n`,(0,e.jsx)(i.h3,{id:\"for-enterprise\",children:\"For Enterprise\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Solution\"}),(0,e.jsx)(i.th,{children:\"Key Features\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Jamf Protect\"}),(0,e.jsx)(i.td,{children:\"Native macOS EDR, MDM integration, threat prevention\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"CrowdStrike Falcon\"}),(0,e.jsx)(i.td,{children:\"Cross-platform EDR, threat intelligence\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Microsoft Defender for Endpoint\"}),(0,e.jsx)(i.td,{children:\"Unified security, Azure integration\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"SentinelOne\"}),(0,e.jsx)(i.td,{children:\"AI-powered detection, automated response\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Trellix Endpoint Security\"}),(0,e.jsx)(i.td,{children:\"Enterprise-grade protection, policy management\"})]})]})]}),`\n`,(0,e.jsx)(i.h2,{id:\"conclusion-staying-safe-in-an-evolving-threat-landscape\",children:\"Conclusion: Staying Safe in an Evolving Threat Landscape\"}),`\n`,(0,e.jsx)(i.p,{children:\"The MacSync Stealer variant discovered in December 2025 represents a significant evolution in macOS malware sophistication. By exploiting Apple's notarization process, attackers have found a way to distribute malware that bypasses the security measures most users rely upon.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Key Takeaways:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Trust but Verify\"}),\": Apple notarization is not a guarantee of safety. Always verify the source and legitimacy of software before installation.\"]}),`\n`]}),`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Defense in Depth\"}),\": Rely on multiple security layers\\u2014Gatekeeper, XProtect, third-party antimalware, and security best practices.\"]}),`\n`]}),`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Cryptocurrency Vigilance\"}),\": If you hold cryptocurrency, use hardware wallets and never expose seed phrases to any software.\"]}),`\n`]}),`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Stay Updated\"}),\": Keep macOS, security definitions, and all applications updated to benefit from the latest protections.\"]}),`\n`]}),`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Report Suspicious Activity\"}),\": If you encounter suspected malware, report it to Apple and security researchers to help protect the community.\"]}),`\n`]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:\"The macOS threat landscape continues to evolve rapidly. While Macs remain generally secure compared to other platforms, the growing sophistication of threats like MacSync Stealer demonstrates that no system is immune. Maintaining awareness, following security best practices, and using appropriate security tools are essential for protecting your data and digital assets.\"}),`\n`,(0,e.jsx)(i.hr,{}),`\n`,(0,e.jsx)(i.h2,{id:\"frequently-asked-questions\",children:\"Frequently Asked Questions\"}),`\n`,(0,e.jsx)(i.h3,{id:\"how-do-i-know-if-my-mac-is-infected-with-macsync-stealer\",children:\"How do I know if my Mac is infected with MacSync Stealer?\"}),`\n`,(0,e.jsx)(i.p,{children:\"Check for these indicators:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[\"Files in \",(0,e.jsx)(i.code,{children:\"/tmp/runner\"}),\" or \",(0,e.jsx)(i.code,{children:\"~/Library/Application Support/UserSyncWorker/\"})]}),`\n`,(0,e.jsx)(i.li,{children:'Unusual processes named \"UserSyncWorker\" in Activity Monitor'}),`\n`,(0,e.jsx)(i.li,{children:\"Unexpected network connections to unfamiliar domains\"}),`\n`,(0,e.jsx)(i.li,{children:\"Missing cryptocurrency or unauthorized account access\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"can-macsync-stealer-steal-my-icloud-keychain-passwords\",children:\"Can MacSync Stealer steal my iCloud Keychain passwords?\"}),`\n`,(0,e.jsx)(i.p,{children:\"Yes, MacSync Stealer can access Keychain data if it obtains your system password through its fake password prompt. This is why you should never enter your password into unexpected dialogs.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"does-apples-xprotect-protect-against-macsync-stealer\",children:\"Does Apple's XProtect protect against MacSync Stealer?\"}),`\n`,(0,e.jsx)(i.p,{children:\"XProtect may detect known variants after Apple updates its definitions. However, new variants can evade detection until signatures are updated. This is why additional security measures are recommended.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"should-i-stop-using-mac-because-of-this-malware\",children:\"Should I stop using Mac because of this malware?\"}),`\n`,(0,e.jsx)(i.p,{children:\"No. While MacSync Stealer is sophisticated, Macs remain secure when users follow best practices. The key is awareness and proper security hygiene\\u2014downloading software only from trusted sources, using strong passwords, and maintaining updated security software.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"how-can-i-protect-my-cryptocurrency-from-mac-malware\",children:\"How can I protect my cryptocurrency from Mac malware?\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Use hardware wallets for significant holdings\"}),`\n`,(0,e.jsx)(i.li,{children:\"Never enter seed phrases into any application or website\"}),`\n`,(0,e.jsx)(i.li,{children:\"Enable 2FA on all exchange accounts\"}),`\n`,(0,e.jsx)(i.li,{children:\"Verify all transactions on a separate device\"}),`\n`,(0,e.jsx)(i.li,{children:\"Consider using a dedicated device for cryptocurrency activities\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"is-my-business-at-risk-from-macsync-stealer\",children:\"Is my business at risk from MacSync Stealer?\"}),`\n`,(0,e.jsx)(i.p,{children:\"Yes, especially if employees download software from unofficial sources. Implement MDM solutions, deploy endpoint protection, conduct security awareness training, and establish clear policies for software installation.\"}),`\n`,(0,e.jsx)(i.hr,{}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.em,{children:\"Last Updated: December 30, 2025\"})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsxs)(i.em,{children:[\"For additional security resources and macOS protection guides, explore our \",(0,e.jsx)(i.a,{href:\"/blog/category/security\",children:\"Security Category\"}),\" or check our comprehensive \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-security-privacy-complete-guide-2025\",children:\"macOS Tahoe Security & Privacy Guide\"}),\".\"]})})]})}function o(n={}){let{wrapper:i}=n.components||{};return i?(0,e.jsx)(i,{...n,children:(0,e.jsx)(d,{...n})}):d(n)}return w(v);})();\n;return Component;","toc":[{"title":"Executive Summary: The MacSync Stealer Threat","url":"#executive-summary-the-macsync-stealer-threat","depth":2},{"title":"Critical Security Alert","url":"#critical-security-alert","depth":3},{"title":"The Growing macOS Malware Landscape","url":"#the-growing-macos-malware-landscape","depth":3},{"title":"Technical Analysis: How MacSync Stealer Works","url":"#technical-analysis-how-macsync-stealer-works","depth":2},{"title":"Origins and Evolution","url":"#origins-and-evolution","depth":3},{"title":"The Notarization Bypass Technique","url":"#the-notarization-bypass-technique","depth":3},{"title":"Detailed Infection Chain","url":"#detailed-infection-chain","depth":3},{"title":"Evasion Techniques","url":"#evasion-techniques","depth":3},{"title":"What Data MacSync Stealer Targets","url":"#what-data-macsync-stealer-targets","depth":2},{"title":"Browser Credentials and Data","url":"#browser-credentials-and-data","depth":3},{"title":"Cryptocurrency Wallets","url":"#cryptocurrency-wallets","depth":3},{"title":"System and Application Data","url":"#system-and-application-data","depth":3},{"title":"Indicators of Compromise (IOCs)","url":"#indicators-of-compromise-iocs","depth":2},{"title":"File Hashes (SHA256)","url":"#file-hashes-sha256","depth":3},{"title":"Network Indicators","url":"#network-indicators","depth":3},{"title":"File System Indicators","url":"#file-system-indicators","depth":3},{"title":"Log Patterns","url":"#log-patterns","depth":3},{"title":"Detection Methods","url":"#detection-methods","depth":2},{"title":"Using Activity Monitor","url":"#using-activity-monitor","depth":3},{"title":"Terminal Commands for Detection","url":"#terminal-commands-for-detection","depth":3},{"title":"Antivirus Detection Names","url":"#antivirus-detection-names","depth":3},{"title":"Removal Guide","url":"#removal-guide","depth":2},{"title":"Immediate Response Steps","url":"#immediate-response-steps","depth":3},{"title":"Protection Strategies","url":"#protection-strategies","depth":2},{"title":"Software Download Safety","url":"#software-download-safety","depth":3},{"title":"Enable macOS Security Features","url":"#enable-macos-security-features","depth":3},{"title":"Browser Security Best Practices","url":"#browser-security-best-practices","depth":3},{"title":"Cryptocurrency Protection","url":"#cryptocurrency-protection","depth":3},{"title":"Enterprise Security Recommendations","url":"#enterprise-security-recommendations","depth":3},{"title":"Apple's Response and Security Implications","url":"#apples-response-and-security-implications","depth":2},{"title":"Actions Taken","url":"#actions-taken","depth":3},{"title":"The Fundamental Security Challenge","url":"#the-fundamental-security-challenge","depth":3},{"title":"What This Means for Users","url":"#what-this-means-for-users","depth":3},{"title":"Related macOS Threats","url":"#related-macos-threats","depth":2},{"title":"AMOS (Atomic macOS Stealer)","url":"#amos-atomic-macos-stealer","depth":3},{"title":"Nova Stealer","url":"#nova-stealer","depth":3},{"title":"Cthulhu Stealer","url":"#cthulhu-stealer","depth":3},{"title":"Recommended Security Solutions","url":"#recommended-security-solutions","depth":2},{"title":"For Individual Users","url":"#for-individual-users","depth":3},{"title":"For Enterprise","url":"#for-enterprise","depth":3},{"title":"Conclusion: Staying Safe in an Evolving Threat Landscape","url":"#conclusion-staying-safe-in-an-evolving-threat-landscape","depth":2},{"title":"Frequently Asked Questions","url":"#frequently-asked-questions","depth":2},{"title":"How do I know if my Mac is infected with MacSync Stealer?","url":"#how-do-i-know-if-my-mac-is-infected-with-macsync-stealer","depth":3},{"title":"Can MacSync Stealer steal my iCloud Keychain passwords?","url":"#can-macsync-stealer-steal-my-icloud-keychain-passwords","depth":3},{"title":"Does Apple's XProtect protect against MacSync Stealer?","url":"#does-apples-xprotect-protect-against-macsync-stealer","depth":3},{"title":"Should I stop using Mac because of this malware?","url":"#should-i-stop-using-mac-because-of-this-malware","depth":3},{"title":"How can I protect my cryptocurrency from Mac malware?","url":"#how-can-i-protect-my-cryptocurrency-from-mac-malware","depth":3},{"title":"Is my business at risk from MacSync Stealer?","url":"#is-my-business-at-risk-from-macsync-stealer","depth":3}],"estimatedTime":16}